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1275JUDGE* i275 Plaintiff, Apple Inc. ("Apple") 


designs and manufactures mobile communication 


Apple Inc. v. Corellium, LLC 


devices, personal computers, and media devices, 
and sells a variety of related software, services, 
accessories, and third-party digital content and 
applications. 10S is Apple's mobile operating 
system (or "OS") for certain devices like the 
iPhone. iOS is publicly available online for free 
download from Apple's servers as part of a 
packaged file. Around 2016 or 2017, Apple 
removed encryption from the kernel, which is the 
core of the operating system that has complete 
control over all system resources. 


In 2017, Defendant, Corellium, LLC 
("Corellium") began developing a commercial 
product ("the Corellium Product") that permits 
users to create tailored, virtual models of iPhones, 
using iOS files loaded by the user. (The Corellium 
Product also virtualizes Android, the mobile 
operating system used by Google, but the Android 
aspects of the Corellium Product are not issue in 
this case.) With its relatively limited functionality, 
among other things, the Corellium Product does 
not virtualize the Apple App Store, and users 
cannot make phone calls or use camera—features 
of interest to the average customer buying an 
iPhone off the shelf. According to testimony of 
developers of the Corellium Product, the product 
is intended to provide an environment in which 
technology security researchers can conduct 
research with features of interest to those 
researchers. Still, there is no evidence that the 
Corellium Product, like other technology, cannot 
be used for unintended purposes, or that Corellium 
can control how users utilize any Corellium 
Product installed on their premises. 


Starting in January 2018, Apple and Corellium 
began engaging in acquisition talks which, if 
successful, would have allowed Apple to acquire 
Corellium (including its people and the Corellium 
Product). During the acquisition process, there 
were several in-person meetings and calls between 
the companies. The Corellium Product was 
demonstrated ("demo'ed") to Apple and there was 
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technical due diligence. In the summer of 2018, 
the potential deal fell apart and Apple did not 
acquire Corellium. 


On August 15, 2019, Apple filed this lawsuit 
alleging that Corellium infringed Apple's 
copyrights in iOS and circumvented its security 
measures in violation of the federal Digital 
Millennium Copyright Act ("DMCA"). Corellium 


1276denies *1276 that it has violated the DMCA or 


Apple's copyrights. Corellium further argues that 
even if it used Apple's copyrighted work, such use 
constitutes "fair use" and, therefore, is legally 
permissible. Apple filed a Motion for Partial 
Summary Judgment [DE 470] and Corellium filed 
a Motion for Summary Judgment [DE 464]. For 
the reasons explained below, on the copyright 
claim, the Court finds that Corellium's use of iOS 
constitutes fair use, and a genuine dispute of 
material facts precludes summary judgment on the 
DMCA claim. Thus, Corellium's motion is granted 
in part and denied in part, and Apple's motion is 
denied.’ 


1 To the extent the parties agree on the facts 
and the facts as stated are supported by the 
evidence, the Court may cite to the parties’ 
Statements of Material Facts ("SOF"). 
Regarding declarations, under the law of 
this Circuit, "[w]hen a party has given clear 
answers to unambiguous questions which 
negate the existence of any genuine issue 
of material fact [for summary judgment], 
that party cannot thereafter create such an 
issue with an affidavit that merely 
contradicts, without explanation, 
previously given clear testimony. Such an 
affidavit would be a sham." McCormick v. 
City of Fort Lauderdale , 333 F.3d 1234, 
1240 (11th Cir. 2003) (internal citation 
omitted). Additionally, the Court does not 
consider evidence that has been stricken 
pursuant to the Court's August 24, 2020 
Order [DE 658] and the parties’ related 
Joint Stipulation [DE 722]. Lastly, citations 
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to the record primarily reflect sealed 
versions of the document, not the publicly 


available copies. 
BACKGROUND 


A. 10S: APPLE'S OPERATING 
SYSTEM 


An operating system is a program that manages 
the resources of the computer, allocating those 
resources to other programs as needed. It manages 
the computer's most basic functions, including the 
user's interaction with the device. iOS is Apple's 
operating system for its iPhone, iPod Touch, and 
until September 25, 2019, iPad. (Andrews Decl. 
[DE 470-4] 4 4.) The iPhone was introduced in 
2007. It is one of the world's first "smartphones" 
and remains one of the most popular consumer 
electronic devices in the world. (Andrews Decl. 4 
3.) For the iPhone, among other things, the ability 
to make phone calls, send text messages, take 
photos, and download apps from Apple's App 
Store are important features of iOS. (Def.’s SOF 
[DE 472] { 3.) 


iOS does not include hardware or some 
components of the secure boot chain (discussed 
below), like Boot ROM, which are built directly 
into the physical device. (Def.’s SOF 4 4.) 
However, iOS encompasses default software 
applications, underlying graphics, images, and 
files that help create the iOS displays, and 
graphical user interface ("GUI") elements installed 
on Apple's mobile devices. (Andrews Decl. 4 6.) 
Generally, GUI is a visual way of interacting with 
a computer using items such as icons and menus.” 
iOS also encompasses the source code and object 
code representing the processes managing the 
execution of applications and utilization of device 


resources.’ (Andrews Decl. § 6.) 


2. https://www.merriam- 


webster.com/dictionary/graphical% 
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Computers come down to one 
basic premise: They operate with 
a series of on and off switches, 
using two digits in the binary 
(base 2) number system—0O (for 
off) and 1 (for on). All data and 
instructions input to or contained 
in computers therefore must be 
reduced to ... | and 0 .... Some 
highly skilled human beings can 
reduce data and instructions to 
strings of 1's and 0's and thus 
program computers to perform 
complex tasks by inputting 
commands and data in that form. 
But it would be inconvenient, 
inefficient and, for most people, 
probably impossible to do so. In 
consequence, computer science 
has developed programming 
languages. These languages, like 
other written languages, employ 
symbols and syntax to convey 
meaning. The text of programs 
written in these languages is 
referred to as source code. And 
whether directly or through the 
medium of another program, the 
sets of instructions written in 
programming languages—the 
source code—ultimately are 
translated into machine 
"readable" strings of I's and 0's, 
known in the computer world as 
object code, which typically are 
executable by the computer .... 
All code is human readable. As 
source code is closer to human 
language than is object code, it 
tends to be comprehended more 
easily by humans than object 


code. 


Universal City Studios, Inc. v. Reimerdes , 
111 F. Supp. 2d 294, 306 (S.D.N.Y. 2000), 
aff'd sub nom. Universal City Studios, Inc. 
v. Corley , 273 F.3d 429 (2d Cir. 2001) 


(internal citation omitted). 


20user% 20interface. 


3 Regarding source code and object code: 
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iOS includes open and partially open source code; 
it includes code that was not *1277 written by 
Apple. (Marineau-Mes Dep. [DE 472-4] 37:6-14.) 
This includes: (1) open source code that Apple 
uses under license (e.g., Secure Socket Layer); (2) 
components for which Apple is the primary owner 
(e.g., WebKit); and (3) aspects where Apple 
contributes some of the code (e.g., the kernel). 
(Andrews Dep. [DE 472-3] 91:22-93:13, 100:20- 
23; Marineau-Mes Dep. 37:6-40:11 (other open 
source components of iOS are the compiler and 
Swift).) Likewise, iOS’ Darwin, which is part of 
the kernel, stems from research dating back thirty 
to forty years—long before Apple developed the 
iPhone. (Marineau-Mes Dep. 37:6-40:6.) For these 
open source components, Apple is key contributor 
to the code bases and, in many cases, invented the 
code and chose to make it available in open 
source. (Marineau-Mes Dep. 39:23-40:7.) 


B. IPSW FILES 


Apple continuously releases new versions of iOS. 
It also releases at least some components of iOS in 
software files known as "IPSW" files. (Andrews 
Dep. 94:13-25; Krstic Dep. [DE 472-1] 126:13- 
127:21; Wang Dep. [DE 472-6] 59:24-61:10.) 
IPSW files are available online for free download 
from Apple's servers, including via links provided 
on third-party sites like ipsw.me. (Def.’s SOF | 6.) 
A user is not presented with or required to agree to 
the iOS Software License Agreement or End User 
License Agreement ("EULA") before 
downloading an IPSW file. (Def.’s SOF § 12; 
Andrews Dep. 95:13-15, 98:14-20.) 


IPSW files have iOS without some of the runtime 
elements such as the cryptographic authorization 
ticket, which authorizes a given version of iOS to 
run in a given piece of hardware. (Krstic Dep. 
126:13-127:21.) Further, many parts of the IPSW 
files are unencrypted, including the kernel, which 
is the core of the operating system that has 
complete control over all system resources. (Def.’s 
SOF 4 8.) Thus, once downloaded, a person can 
read some of the file contents, and it is possible to 
access contents of the kernel, as well as extract 
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other parts of the file. (Krstic Dep. 67:12-21, 
129:21-130:4; Marineau-Mes Dep. 57:2-10.) The 
kernel can run on non-Apple devices, but 
protections put in place by Apple—which intends 
for the kernel to run on Apple devices—makes it 
difficult to do so. (Krstic Dep. 130:23-132:13, 
141-143:3.) The IPSW files also contain image 
files such as wallpaper. (Def.’s SOF 4 7.) 


C. APPLE'S TECHNICAL 
CONTROL MEASURES 


Apple designs 10S and devices running iOS as an 
integrated hardware/software system. (Pl.’s SOF 
[DE 470-2] 4 10.) Apple does not provide the 
functionality to "clone" or copy the complete 
contents of an iPhone. (/d. 4 11.) Combining 
hardware, software, and service features, Apple 
has put security measures in place to protect its 
devices and customers’ experience. (PI.’s Resp. to 
Second Interr. No. 16 [DE 553-9].* ) In its motion, 


1278Apple focuses on the following measures:*1278 


Authorization Server : According to Apple, upon 
installing iOS on an Apple device (e.g., iPhone), 
the device must first communicate with Apple's 
"authorization server" for approval. The device 
sends information to Apple about the physical 
iPhone and the version of iOS the user seeks to 
install. The authorization server checks this 
information, and if the information presented 
checks out, returns a cryptographic signature 
(known as an "AP Ticket") authorizing installation 
on the device. The signed AP Ticket is saved to 
the device and is required to be checked every 
time the device tries to run iOS. (PI.’s SOF 4 14- 
15.) Corellium disagrees with this statement, 
asserting instead that "iOS in the public IPSW 
distribution ... has no such requirements—this 
security function is hard-coded into physical 10S 
devices." (Def.’s Resp. SOF [DE 513] 9 14-15.) 


4 The parties disagree on the nature, 
operation, and purpose of some of these 


measures. 
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Secure boot chain : Secure boot chain is a way 
Apple prevents unauthorized code from running 
on its systems. The process involves an interaction 
between iOS and software embedded in the 
physical device. (Wang Dep. 62:8-18, 212:4-22; 
Marineau-Mes Dep. 36:6-23.) It is "an extremely 
well-meaning and well-designed feature that is 
intended to safeguard the privacy and security of 
Apple iPhone users[.]" (P1.’s SOF 4 18.) The boot 
chain is "secure" because each step must be 
verified before the next step can proceed. (Wang 
Dep. 212:4-22; Pl.’s SOF 4 17.) 


Buddy program : When iOS is freshly installed on 
an Apple device, a program called "Buddy" runs. 
The "Buddy" program helps the user set up iOS on 
the device. One portion of the "Buddy" program 
presents the EULA governing that version of 10S 
to the user on the iOS device. A user must accept 
the EULA before the user can continue to interact 
with any other part of iOS. If the user does not 
accept the EULA, the Buddy program prevents the 
user from further accessing iOS. (Andrews Decl. { 
17.) 


Trust Cache : The trust cache is a list of trusted 
applications that Apple has approved for execution 
on iOS. The trust cache prevents users from 
installing and operating unapproved applications 
on iOS. The trust cache prevents the installation of 
rogue software and ensures that only-Apple- 


verified applications can be run on iOS. (PI.’s SOF 


21.) 


Pointer Authentication Codes (or PAC) : This 
hardware feature works with Apple software to 
protect iOS and makes it "difficult or impossible" 
for the kernel to run on non-Apple platform. 
(Krstic Dep. 132:25-133:17, 140:23-141:18, 
142:19-143:3.) Apple began implementing custom 
PAC with the release of iOS 12.0 for the iPhone 
XR, XS, and XS Max in September 2018. (PI.’s 
SOF 4 22.) PAC is a cryptographic signature 
Apple inserts and stores in various places in iOS 
code to ensure that the code is executed as 
intended, without modification or distortion. 
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When the device processor receives certain 


cryptographic 
measurement for the next instruction it has been 


instructions, it generates the 
asked to execute. If the measurement does not 
match the stored PAC, the processor will halt 
execution. (Id. ) 


D. THE CORELLIUM PRODUCT 


Corellium was founded in August 2017. (Gorton 
Dep. [DE 472-25] 20:8; Skowronek Dep. [DE 
472-20] 46:21-47:2.) Development of a prototype 
of the Corellium Product began around summer 
2017. (Gorton Dep. 33:5-21.) By January 2018, 
Corellium was able to demo the creation of a 
virtual device and was able to use the virtual 
device in basic ways. (Gorton Dep. 33:22-34:20). 
Corellium developed both a cloud (or online) 
version and an on-premises version (1.e., where the 


customer purchases and installs a server on their 


1279premises) of *1279 the Corellium Product. By the 


end of January 2018, a trial version (Version 1.1) 
of the cloud-based product was offered to a 
limited number of users for beta testing (to detect 
bugs and any usability issues) and business 
development. (Gorton Dep. 52:23-53:9; Def.’s 
Fourth Am. Ans. to First Interr. No. 1 [DE 470- 


9}.) 


The Corellium Product enables users to create and 
interact with virtual devices by loading firmware 
(that is, files for operating systems like iOS, 
Android, (Def.’s SOF § 30.) 
Virtualization is the ability to run software on 


and Linux). 


hardware it is not ordinarily meant to run on. 
(Wang Dep. 55:10-21.) Among other reasons, 
virtualization is beneficial because it permits the 
user to run software on faster hardware and 
permits examination and debugging of the 
software to get a better understanding of how it 
works. (Wang Dep. 55:10-21.) According to 
Corellium's founders, the Corellium Product was 
developed with the primary intent of facilitating 
security testing, research, and development by, 
inter alia , allowing researchers to examine 
aspects of iOS code. (Wade Dep. 179:17-20, 
180:12-13; Wang Dep. 210:9-212:3; Gorton Dep. 
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50:20-51:5; Skowronek Dep. 71:18-23, 96:21- 
97:2.) Security research is an activity designed to 
find unintended and unknown weaknesses in a 
system, including through source code inspection 
and certain runtime debugging. (Krstic Dep. 
123:12-124:3.) Among other things, security 
researchers are interested in whether software has 
vulnerabilities and how and if those vulnerabilities 
can be exploited and defended against. (Wang 
Dep. 249:17-22.) Security researchers include, for 
example, members of Apple's Security Bug 
Bounty Program, a program that rewards 
researchers who help find vulnerabilities in 
(Krstic Dep.  181:5-9.) 
Vulnerability is a technical term for a bug that has 


Apple's products. 
security impact; that is, if exploited, it can 
undermine the security of the user's system. 
(Krstic Dep. 102:4-6.° ) Security researchers can 
use their talent for good or for nefarious purposes. 
(Pl.’s SOF § 61.) 


5 "In some context a bug could be different 
from a vulnerability .... An exploit uses a 
vulnerability to achieve a purpose," such as 
a jailbreak. (Wang Dep. 51:9-14, 52:15- 
53:10.) Jailbreaking is a "mechanism to 
exploit security vulnerability or allow 
execution of code that didn't come from 
[the developer]." Jailbreaking can be used 
for good. (Andrews Dep. 97:6-98:13.) 


Turning back to the Corellium Product, Corellium 
directly sells to customers and has, until recently, 
used a reseller for the on-premises version of the 
product.® (Gorton Dep. 15:1-16:2, 53:15-54:14, 
125:17-19, 127:1-11.) For its 
Corellium has a vetting process. (Gorton Dep. 
52:14-18, 116:7-126:6; Dyer Dep. [DE 472-32] 
32:2-36:15, 39:13-40:14, 46:14-57:13.) Generally, 
upon receiving an inquiry, the process begins with 


direct sales, 


an initial evaluation. This initial analysis takes 


several factors into consideration, including 
whether the inquiry came from an enterprise 
account or from an individual account (e.g., a 
Gmail account). Corellium also considers the 


nature of the content of the inquiry and whether it 
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comports with Corellium's intended use for its 
product. For example, if the inquiry requests the 
ability to run 10S on an Android mobile device, 
Corellium discards it. Similarly, if there are red 
flags based on the identity of a putative customer 
(e.g., someone involved with unlawful activity) or 
based on the geographic origins of the request, 
Corellium does not engage. 


6 Corellium contracted with two resellers but 
only one has engaged in any sales. (Gorton 
Dep. 15:25-16:16.) 


If Corellium finds, after the initial evaluation, that 
the request might be a qualified lead, it responds 
and starts a line of communication with the 


putative customer. Discussions at this stage may 


1280entail a telephone *1280 conversation, demo of the 


Corellium Product, providing a data sheet of 
product features and pricing or an order form with 
license terms, or an offer of a trial period in the 
cloud. In some cases, Corellium also continues to 
investigate the potential customer to determine, 
for instance, the nature of their business and their 
affiliations. Red flags during this investigation 
may result in a decision by Corellium not to 
continue to engage with the company. [Redacted]. 
(Gorton Dep. 123:3-124:25, 163:8-164:7; Dyer 
Dep. 143:9-144:5, 150:15-153:11.) The vetting 
process is similar for the on-premises and cloud 
versions of the Corellium Product, except that for 
the cloud product, Corellium may sell to locations 
they are not otherwise comfortable shipping 
servers to. (Gorton Dep. 125:21-126:6.) 


In terms of Corellium's control of the use of its 
product, customers are not required to report bugs 
or vulnerabilities in iOS to Apple or Corellium. 
(Gorton Dep. 128:7-130:16.) However, for the 
cloud product, if there are concerns regarding 
malicious activity, Corellium can log into an 
account, investigate, and terminate the account, if 
necessary. (Gorton Dep. 98:1-6, 99:13-17, 107:10- 
20; Wade Dep. 204:4-15, 205:14-207:16, 208:24- 
15.) Corellium does not have the same control 
over the on-premises version of the Corellium 
Product; there is no way to even know where the 
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product is after it has been shipped from 
Corellium, and customers are not required to keep 
the product in a particular location upon sale. 
Instead, Corellium asserts that it relies on the legal 
enforcement of licensing or end user agreements 
to ensure that its customers comply with any legal 


requirements. 


Corellium's CEO and its Vice President of Sales 
and Business Development testified that the 
typical inquiry received pertains to application 
security testing, operating system security testing, 
training, and "miscellaneous." "Miscellaneous" 
requests are not received often but might include 
things like continuous integration or the 
development of tools, such as forensics tools. 
(Gorton Dep. 118:4-24; see also Dyer Dep. 48:5- 
17, 83:9-105:15.) While Corellium may engage 
with iOS app developers, these developers are not 
target customers, and Corellium generally does 
not advertise for application development, because 
the Corellium Product "is designed for security 
testing and research particularly," and "[t]he price 
point makes it unattractive to app developers ...." 
(Gorton Dep. 118:14-24.) 


Once Corellium decides to sell the product, for 
either version of the Corellium Product, customers 
must pay an annual licensing fee and must 
purchase a server. Additionally, if the user chooses 
the Enterprise or Premium edition of the 
Corellium Product they must pay an upgrade fee. 
(Gorton Dep. 92:13-95:21; Dyer Dep. 66:1-24.) 
On-premises customers perform their own install 
and upgrades and manage their network. (Gorton 
Dep. 98:23-99:2; Wang Dep. 99:23-103:7, 106:4- 
7.) Prior to April 2018, upon setting up the 
hardware and IP settings, an on-premises customer 
would not need to take additional steps to setup, as 
firmware (e.g., IPSW file) links were provided by 
ipsw.me. (Def.’s Fourth Am. Ans. to First Interr. 
No. 2.) However, for versions of the Corellium 
Product released between April 2018 and March 
2019, an additional step of obtaining IPSW files 
must be performed and the files must be placed in 
[Redacted]. (Def.’s Fourth Am. Ans. to First 
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Interr. No. 2.) Then, for versions of the Corellium 
Product released during or after March 2019, there 
are additional steps to get to the directory 
permitting download of the IPSW files required to 
set up iOS devices. (Def.’s Fourth Am. Ans. to 
First Interr. No. 2.) The setup for cloud-based 


customers is more straightforward; users log into 


1281 their online account to get started.*1281 At the 


point users are ready to create a virtual iOS 
device, Corellium maintains an IPSW database 
which matches physical devices with available 
versions of iOS and the associated internet 
download addresses (URLs) for each IPSW file. 
(Pl.’s SOF § 51.) From early 2019 until February 
2020, Corellium's cloud interface included a 
"dropdown" menu that enabled its customers to 
select from a prepopulated list of iOS versions and 
iOS Devices. The customer would pick a version 
of iOS and device from that menu (e.g., iPhone 11 
Max running iOS 13), and the Corellium Product 
would automatically download the associated 
IPSW file from Apple's servers. (Pl.’s SOF §] 52.) 
Corellium also instructs its customers on how to 
manually download IPSW files from Apple's 
servers and then load or import those files into the 
Corellium Product to create iOS virtual devices. 
(Pl.’s SOF § 53.) Thus, customers obtain IPSW 
files by manual download or by a Corellium 
program that automates downloading the IPSW 
files from Apple servers. On-premises customers 
have the option of saving IPSW files manually. 
(Def.’s SOF §] 55.) Each time a Cloud user wants 
an IPSW file, the user must download it from 
Apple's servers; Corellium does not save the 
IPSW file on its system. (Wang Dep. 152:18- 
153:1.") 


7 There is evidence that, at least once, 
Corellium provided IPSW files to its 
reseller for a demo unit. (Azimuth Security, 


LLC Dep. [DE 557-13] 175:176:4.) 


The Corellium Product dynamically unpacks 
IPSW files as they are downloading. (Def.’s SOF 
4 53.) The files are "transiently stored" until they 
can be transferred to the right compute node and 
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translated, and are there for a "very short amount 
of time." (Wang Dep. 173:8-17; Skowronek Dep. 
116:2-117:1, 119:13-120:22, 166:8-19.) 
Additionally, in creating virtual devices, the 
Corellium Product does not use iOS in the form in 
which it exists within the downloaded IPSW files. 
Rather, once a user loads the firmware, the 
Corellium Product "transforms" iOS by 
[Redacted]® . (Def.’s SOF § 66.’ ) Thus, following 
the transformation process, the software involved 
in creating the virtual device derives from a 
combination of Corellium's code and Apple's iOS 
code. (Wang Dep. 158:13-159:16, 161:15-162:5, 
195:17-23; Andrews Dep.  102:23-103:16.) 
Additionally, Corellium ordinarily avoids using 
encrypted parts of the IPSW files because it 
cannot decrypt them. (Wang Dep. 64:2-15, 65:4- 
12, 259:19-24.) However, if a user has an 
unencrypted version of otherwise encrypted 
portions of the firmware, the Corellium Product 
allows the user to load it and see those portions 
displayed in the Corellium Product. (Gorton Dep. 
96:9-19.) 


8 [Redacted]. 


9 Corellium uses the term "transform" to 
describe this process, while Apple appears 
to prefer the word "modify." Regardless if 
it is a "transformation" or "modification," 
there are some changes made once the user 
loads the IPSW files. Hence, the Court uses 
the words "change," "modify," and 


"transform" interchangeably. 


E. ACQUISITION EFFORTS 


Between January 2018 and the summer of 2018, 
the parties engaged in discussions regarding 
Apple's potential acquisition of Corellium. During 
this time, the parties met in-person and 
telephonically. Corellium explained to Apple the 
technology behind the Corellium Product and how 
it works, and discussed Corellium's business and 
intention to commercialize the Corellium 


1282Product.'° In addition to several engineers, *1282 


discussions involved Apple's Senior Vice 
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President of Software Engineering, the Vice 
President of OS Software Engineering, and the 
Head of Apple's Security Engineering and 
Architecture. (See Federighi, Andrews, & Krstic 
Dep., supra n.10.) Corellium also provided Apple 
with a temporary account or administrative access 
to the Corellium Product. (Andrews Dep. 50:15- 
54:9, 60:15-20, 168:17-25.) While Apple's legal 
department did not formally discuss copyright 
violations with Corellium, there is a dispute as to 
whether, and to what extent, Corellium was told 
by Apple employees that Corellium needed a 
license to utilize iOS in connection with the 
Corellium Product. (Wade Dep. 276:4-15, 278:1- 
5; Federighi Dep. 42:9-44:8, 115:12-14, 128:2-9, 
132:8-133:4.) 


10 see, e.g. , Gorton Dep. 177:22-178:8, 
180:18-181:17; | Andrews Dep. 48:23- 
49:25, 50:15-54:9, 60:15-20, 102:13-22, 
112:23-113:13,  133:2-134:4, — 162:14- 
163:12, 168:17-25, 188:17-24; Krstic Dep. 
72:12-23, = 74:18-75:3, — 143:20-144:6, 
149:6-15; Wade Dep. 274:4-276:15; Smith 
Dep. [DE 472-28] 64:13-65:25, 83:18- 
84:10, 134:4-135:3; Federighi Dep. [DE 
472-10] 31:8-23, 73:5-13, 142:8-23. 


If Apple had acquired the Corellium Product, the 
product would have been used internally for 
testing and validation (that is, for verifying any 
system weaknesses and functioning of devices). 
(Marineau-Mes Dep. 27:3-22, 121:17-19; Krstic 
Dep. 171:22-25; Smith Dep. 61:16-19.) Even with 
the Corellium Product, Apple would still need 
physical iPhones to conduct its testing. (Wade 
Dep. 210:20-21; Marineau-Mes Dep. 200:10- 
202:18.) Generally, the Corellium Product 
received positive feedback from Apple employees. 
(Andrews Dep. 159:13-16, 192:23-193:15; Krstic 
Dep. 106:5-10.) But there were also concerns, 
including regarding its utility and long-term value 
to Apple. (Krstic Dep. 106:5-107:12, 110:9-22.) 


The parties ultimately could not agree on a price 
and, as a result, acquisition efforts were unfruitful. 
Roughly a year after talks fell apart, Apple filed 
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this suit. (See Compl. [DE 1].) 
F. SECOND 


COMPLAINT 


In the Second Amended Complaint [DE 589], 
Apple asserts claims against Corellium for Direct 


AMENDED 


Federal Copyright Infringement (Computer 
Programs), 17 U.S.C. § 501, Direct Federal 
Copyright Infringement (Graphical User Interface 
Elements), 17 U.S.C. § 501, Contributory Federal 
Copyright Infringement, 17 U.S.C. § 501, and 
Unlawful Trafficking, 17 U.S.C. §§ 1201(a)(2), 
(b), 1203. Apple contends that Corellium 


1283infringed on the following products:* 1283 


iOS 12.1.1 
. Registration Registration 
Title of Work 
Date No. 
20, TX -205- 
108 9.0 June 0, 8-205 
2016 229 
21,TX -205- 
108 9.1 June ; 8-205 
2016 204 
N TX -344- 
108 10.0 ovember 8-3 
10, 2016 158 
D -609- 
(08 11.0 ecember TX 8-609 
22,2017 048 
A -584- 
(08 11.0.1 ugust 8,TX 8-584 
2018 724 
TX -634- 
OS 112 November 9, 8-634 
2018 702 
N -647- 
108 11.25 ovember 9,TX 8-647 
2018 053 
A -584- 
108 113 ugust 8,TX 8-584 
2018 722 
108 114 July 23,TX 8-611- 
2018 420 
D -651- 
‘OS 12.0 ecember 4,TC 8-651 


2018 122 
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J 25, 2019 oe 
anua 
ee 993 
2 -759- 
108 12.2 June 5,TX 8-759 


2019 263 
Apple teens, = 408-4 
pple moms ™” "October 19,VA 2-061- 


ilati - iPh 
compilation iPhone 2016 057 


6s Built-in Apps 
Apple icons - iOS 11 
pe ee December 8,VA_ 2-100- 


ilation - iPhone 8 
compilation - iPhone 3017 045 


Built-in Apps 


Apple Bokeh (bubble)March 27,VA — 1-922- 
Wallpaper iOS 7 2014 660 
Apple Wallpaper 


August 19,VA — 1-967- 
Flower Magenta (iOS ite ° 


2015 209 
8) 
Apple Wallpaper - 
Flower August 19,VA _— 1-967- 
Chrysanthemum purple2015 206 
(iOS 8) 


(Sec. Am. Compl., Ex. A.) Each of Apple's 
copyright registrations "[e]xclude ... [p]reviously 
published Apple material," including _ prior 
versions of iOS. (Def.’s SOF § 21.) 


SUMMARY JUDGMENT STANDARD 


Under Federal Rule of Civil Procedure 56, 
"summary judgment is proper if the pleadings, 
depositions, answers to interrogatories, and 
admissions on file, together with the affidavits, if 
any, show that there is no genuine issue as to any 
material fact and that the moving party is entitled 
to a judgment as a matter of law." Ce/otex Corp. v. 
Catrett, 477 U.S. 317, 322, 106 S.Ct. 2548, 91 
L.Ed.2d 265 (1986). "[G]enuine disputes of facts 
are those in which the evidence is such that a 
reasonable jury could return a verdict for the non- 
movant." Mann vy. Taser Int'l, Inc., 588 F.3d 1291, 
1303 (11th Cir. 2009) (internal marks and citation 
omitted). A fact is material if, under the applicable 
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substantive law, it might affect the outcome of the 
case. Anderson v. Liberty Lobby, Inc., 477 U.S. 
242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). 


A party seeking summary judgment bears the 
initial responsibility of supporting its motion and 
identifying those portions of the record which it 
believes demonstrate the absence of a genuine 
issue of material fact. Celotex , 477 U.S. at 323, 
106 S.Ct. 2548. "[A]t the summary judgment stage 
the judge's function is not himself to weigh the 
evidence and determine the truth of the matter but 
to determine whether there is a genuine issue for 
trial." Anderson , 477 U.S. at 249, 106 S.Ct. 2505. 
The Court "must view all the evidence and all 
factual inferences reasonably drawn from the 
evidence in the light most favorable to the 
nonmoving party and must resolve all reasonable 
doubts about the facts in favor of the non- 
movant." Rioux v. City of Atlanta, Ga. , 520 F.3d 
1269, 1274 (11th Cir. 2008) (internal marks and 
citation omitted). 


DISCUSSION 


Apple's claims fall in two buckets: copyright 
infringement and violation of section 1201 of the 
DMCA. In its motion, Corellium argues it is 
entitled to summary judgment in its favor because 


1284(1) the Corellium *1284 Product contains no 


copyrighted Apple code, (2) the fair use doctrine 
makes any use of protectable elements of Apple's 
work permissible, (3) Apple misused its copyright, 
(4) Apple should be estopped from asserting a 
copyright claim against Corellium, (5) Apple 
cannot show that Corellium infringed any of the 
17 copyrights at issue in the Second Amended 
Complaint,'! and (6) the Corellium Product does 
not violate the DMCA. Apple also moves for 
partial summary judgment on the DMCA issue, 
arguing it is entitled to summary judgment in its 
violated the 
antitrafficking provisions of the statute. 


favor because Corellium 


11 Apple initially identified 22 copyright 
registrations at issue but has since removed 


5 of them. Compare Compl., with Sec. Am. 
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Compl. 


Before turning to the DMCA, the Court will 
analyze the copyright claim. If the Court agrees 
that the fair use doctrine applies, Corellium's other 
arguments are rendered moot. Thus, the Court will 
address that argument first. 


I. COPYRIGHT CLAIM 


A. The Copyright Clause 


The Copyright Clause of the United States 
Constitution provides: 


The Congress shall have Power ... To 
promote the Progress of Science and useful 
Arts, by securing for limited Times to 
Authors and Inventors the exclusive Right 
to their 


respective Writings and 


Discoveries .... 


U.S. CONST. art. I, § 8, cl. 8. The Copyright 
Clause is "both a grant of power and a limitation," 
and "to the extent [Congress] enacts copyright 
laws at all," such laws must "promote the Progress 
of Science." Eldred v. Ashcroft , 537 U.S. 186, 
212, 123 S.Ct. 769, 154 L.Ed.2d 683 (2003). 
Indeed, "[t]he primary objective of copyright is 
not to reward the labor of authors, but ‘[t]o 
promote the Progress of Science and useful Arts.’ 
" Feist Publ'ns, Inc. v. Rural Tel. Serv. Co. , 499 
U.S. 340, 349, 111 S.Ct. 1282, 113 L.Ed.2d 358 
(1991) (citing the Copyright Clause). Even in the 
technological era, "the Copyright Act must be 
construed in light of this basic purpose." Twentieth 
Century Music Corp. v. Aiken , 422 U.S. 151, 156, 
95 S.Ct. 2040, 45 L.Ed.2d 84 (1975). 


B. Fair Use 


From the infancy of copyright protection, courts 
have recognized that some opportunity for fair use 
of copyrighted materials is necessary to fulfill 
copyright's purpose of promoting "the Progress of 
Science and useful Arts." Campbell v. Acuff-Rose 
Music, Inc. , 510 U.S. 569, 575, 114 S.Ct. 1164, 
127 L.Ed.2d 500 (1994) (citing the Copyright 
Clause). "If copyright's utilitarian goal is to be 
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met, we must be careful not to place overbroad 
restrictions on the use of copyrighted works, 
because to do so would prevent would-be authors 
from effectively building on the ideas of others." 
Cambridge Univ. Press v. Patton , 769 F.3d 1232, 
1238 (11th Cir. 2014) (citation omitted). "In a 
sense, the grant to an author of copyright in a 
work is predicated upon a reciprocal grant to the 
public by the work's author of an implied license 
for fair use of the work." Jd. at 1257 (citation 
omitted). "[C]opyright is not an inevitable, divine, 
or natural right that confers on authors the 
absolute ownership of their creations. It is 
designed rather to stimulate activity and progress 
in the arts for the intellectual enrichment of the 
public." /d. at 1256. 


"Some unpaid use of copyrighted materials must 
be allowed in order to prevent copyright from 
functioning as a straightjacket that stifles the very 


1285creative *1285 activity it seeks to foster." Jd. at 


Z 


1238. "If we allow too much unpaid copying, 
however, we risk extinguishing the economic 
incentive to create that copyright is intended to 
provide." Jd. Therefore, "a secondary user who 
takes overmuch in the name of fair use operates 
outside the bounds of his or her implied-by-law 
license." Jd. at 1257. 


Pursuant to its authority under the Copyright 
Clause, Congress codified the judicially-created 
fair use defense, "to ensure that copyright 
protection advances rather than thwarts the 
essential purpose of copyright ....". Lexmark Int'l, 
Inc. v. Static Control Components, Inc. , 387 F.3d 
522, 537 (6th Cir. 2004). Section 107 of the 


Copyright Act provides: 
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[T]he fair use of a copyrighted work, 
including such use by reproduction in 
copies ... for purposes such as criticism, 
comment, news reporting, teaching 
(including multiple copies for classroom 
use), scholarship, or research, is not an 
infringement of copyright. In determining 
whether the use made of a work in any 
particular case is a fair use the factors to be 


considered shall include 


(1) the purpose and character of the use, 
including whether such use is of a 
commercial nature or is for nonprofit 


educational purposes; 


(2) the nature of the copyrighted work; 


(3) the amount and substantiality of the 
portion used in relation to the copyrighted 
work as a whole; and 


(4) the effect of the use upon the potential 
market for or value of the copyrighted 
work. 


IFSC. 4 107. 


The enumerated examples criticism, 


(c.g., 
comment, and research) are meant to give some 
idea of the sort of activities courts might regard as 
fair use under the circumstances. Patton , 769 F.3d 
at 1259. "This listing was not intended to be 
exhaustive, or to single out any particular use as 
presumptively a ‘fair’ use." /d. (citation omitted). 
Likewise, the four statutory factors are not 
exclusive. Harper & Row Publishers, Inc. v. 
Nation Enters. , 471 U.S. 539, 560, 105 S.Ct. 
2218, 85 L.Ed.2d 588 (1985). However, they 
"establish the contours within which a court may 
investigate whether, in a given case, a finding of 
fair use would serve the objectives of copyright." 
Id. These factors are not to be treated in isolation 
one from another. Campbell , 510 U.S. at 578, 114 
S.Ct. 1164. Rather, "[a]ll are to be explored, and 
the results weighed together, in light of the 
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purposes of copyright." Jd. Still, some factors may 
weigh more heavily on the fair use determination 
than others. Patton , 769 F.3d at 1260 ; see, e.g. , 
Campbell , 510 U.S. at 586, 114 S.Ct. 1164 
(noting that the second factor—nature of the work 
—is generally not important in determining 
whether a finding of fair use is justified in the case 
of a parody); Harper & Row Publishers , 471 U.S. 
at 566, 105 S.Ct. 2218 (noting that the fourth 
factor—effect on market value—"is undoubtedly 
the single most important element of fair use."). 


"The affirmative defense of fair use is a mixed 
question of law and fact as to which the proponent 
carries the burden of proof." Peter Letterese & 
Assocs., Inc. v. World Inst. Of Scientology Enters. , 
533 F.3d 1287, 1307 n.21 (11th Cir. 2008). Thus, 
the burden is on Corellium to "convince the court 
that allowing [its] unpaid use of copyrighted 
material would be equitable and consonant with 
the purposes of copyright." Patton , 769 F.3d at 
1238. Where material facts are not in dispute, fair 
use is appropriately decided on summary 
judgment. See, e.g. , Stewart v. Abend , 495 U.S. 
207, 214, 236-38, 110 S.Ct. 1750, 109 L.Ed.2d 
184 (1990). 


With these principles in mind, the Court now 


i286analyzes each of the relevant factors.*1286 1. 


Z 


Purpose and character of the allegedly 


infringing use 


Under this first factor, courts consider "(1) the 
extent to which the use is a ‘transformative’ rather 
than merely superseding use of the original work 
and (2) whether the use is for a nonprofit 
educational purpose, as opposed to a commercial 
purpose." Patton , 769 F.3d at 1261. These facets 
do not create "hard evidentiary presumption[s]" or 
"categories of presumptively fair use." Campbell , 
510 U.S. at 584, 114 S.Ct. 1164. In other words, 
"the mere fact that a use is educational and not for 
profit does not insulate it from a finding of 
infringement, any more than the commercial 
character of a use bars a finding of fairness." Jd. 
Rather, the commercial or non-transformative uses 
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of a work are to be regarded as "separate factor[s] 
that tend[ ] to weigh against a finding of fair use," 
and "the force of that tendency will vary with the 
context." /d. at 585, 114 S.Ct. 1164 (citation 
omitted). 


a. Transformative 


In deciding if the alleged infringing use of the 


copyrighted work is transformative, courts 


consider " 


‘whether the new work merely 
supersede[s] the objects of the original creation, or 
instead adds something new, with a further 
purpose or different character, altering the first 
with new expression, meaning, or message.’ " 
Patton , 769 F.3d at 1262 (citing Campbell , 510 
U.S. at 579, 114 S.Ct. 1164 ). "Even verbatim 
copying ‘may be transformative so long as the 
copy serves a different function than the original 
"Td. While a 


transformative use is " ‘not absolutely necessary 


work.’ (citation omitted). 


for a finding of fair use,’ ... transformative uses 
tend to favor a fair use finding because a 
transformative use is one that communicates 
something new and different from the original or 
expands its utility, thus serving copyright's overall 
objective of contributing to public knowledge." 
Authors Guild v. Google, Inc. , 804 F.3d 202, 214 
(2d Cir. 2015) (citing Campbell , 510 U.S. at 579, 
114 S.Ct. 1164 ). Thus, copying from an original 
for the purpose of criticism or commentary on the 
original or to provide information about it, tends 
satisfy the notion of the 
‘transformative’ purpose involved in the analysis 
of factor one. /d. at 215-16. "The more the 
appropriator is using the copied material for new, 


most clearly to 


transformative purposes, the more it serves 
copyright's goal of enriching public knowledge 
and the less likely it is that the appropriation will 
serve as a substitute for the original or its plausible 
shrinking the 
opportunities of the copyrighted work." Jd. at 214 


(citing Campbell , 510 U.S. at 591, 114 S.Ct. 1164 
). 


derivatives, protected market 


1287 


gy 
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Apple disagrees with Corellium that the Corellium 
Product is transformative. According to Apple, the 
Corellium Product is not transformative because 
Corellium merely modifies 10S and "offers the 
software in a different medium—virtually, rather 
than on a physical device." (Pl.’s Resp. [DE 557- 
1] at 13.) For support, Apple cites cases like 
Oracle America, Inc. v. Google LLC , 886 F.3d 
1179, 1187 (Fed. Cir. 2018), where courts found 
the mere repackaging of copyrighted material 
from one medium to the next, without new content 
or meaning, to be non-transformative. 


Here, the evidence establishes that the Corellium 
Product is not merely a repackaged version of iOS 
—this time in a virtual environment as opposed to 
Rather, 
changes to iOS and incorporates its own code to 


an iPhone. Corellium makes several 
create a product that serves a transformative 
purpose. The Corellium Product makes available 
significant information about iOS, permitting 
users to, inter alia : (1) see and halt running 
(2) modify the (3) use 
CoreTrace, a tool to view system calls; (4) use an 


processes; kernel; 
app *1287 browser and a file browser; and (5) take 
live snapshots. These features are beneficial to 
security research. And, as Apple concedes, the 
Corellium Product adds significant features that 
are not available on Apple's devices running 10S. 


Unequivocally, this case is not like Oracle . In 
Oracle , the defendant, Google, copied verbatim 
the declaring code of a number of the plaintiff's 
copyrighted and patented application 
programming interface ("API") packages; made 
no alteration to the expressive content or message; 
and used the API packages in Google's competing 
Android operating system for the same purpose as 
plaintiff's use of API packages in its own platform. 
886 F.3d at 1185-1211. Oracle is distinguishable 
from this case, where Corellium transforms iOS 
and adds new content, Corellium is not a direct 
competitor with Apple in the iOS device market, 
and the Corellium Product has functionalities not 


available on Apple's iOS devices. 
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The Court finds that the purpose of the Corellium 
Product in this case is more akin to Google's 
transformative search and snippet function in 
Authors Guild . In that case, the plaintiffs— 
authors of published books under copyright—sued 
Google for copyright infringement. 804 F.3d at 
206-11. Acting without the authors’ permission, 
Google made digital copies of tens of millions of 
books that were submitted to it in connection with 
its Library Project and its Google Books project. 
Id. Google scanned the digital copies and 
established a publicly available search function, 
which allowed internet users to search without 
charge to determine whether the book contains a 
specified word or term and see "snippets" of text 
containing the searched-for terms. /d. Google also 
allowed the participating libraries to download and 
retain digital copies of books, and Google retained 
the original scanned image of each book and all 
the digital information created in the process on its 
servers. Id. 


Google argued that its actions constituted fair use. 
Id. at 211, 214-19. The plaintiffs disagreed. On the 
issue of transformativeness, plaintiffs argued that 
Google's digital copying of entire books, the 
snippet feature (which allowed users to read 
portions of the book), and Google's distribution of 
digital copies to the libraries did not constitute 
transformative use but, rather, provided a 
substitute for plaintiffs’ works and subjected 
plaintiffs to the risk of loss of copyright revenues 
through access allowed by libraries. Jd. The 
Second Circuit rejected plaintiffs’ arguments and 


sustained the district court's finding of fair use. 


Finding Google's search function and snippet view 
to be transformative, the Second Circuit explained 
that "the purpose of Google's copying of the 
original copyrighted books is to make available 
books, 
permitting a searcher to identify those that contain 


significant information about those 
a word or term of interest" and "to learn the 
frequency of usage of selected words in the 
aggregate corpus of published books in different 


historical periods." Jd. Snippet view, which was 
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"designed to show the searcher just enough 
context surrounding the searched term to help her 
evaluate whether the book falls within the scope of 
her interest," added "to the highly transformative 
purpose of identifying books of interest to the 
searcher." /d. 


Here, like Google's search and snippet functions, 
the Corellium Product makes available significant 
information about iOS. A user can see running 
processes, halt execution of the virtual device, 
amend the kernel, look at lists of files, clone 
snapshots, among other things—giving great 
introspection into aspects of iOS and its operation 


on iOS devices. These tools are useful to security 


1288research and testing. *1288 The product creates a 


Z 


new, virtual platform for iOS and adds capabilities 
not available on Apple's iOS devices. See Sony 
Comput. Entm't, Inc. v. Connectix Corp. , 203 F.3d 
596, 599, 606 (9th Cir. 2000) (finding fair use 
where defendant made intermediate copies of 
defendant's copyrighted software program and, by 
reverse engineering, created defendant's own 
software program which emulated the functioning 
of plaintiff's game console so users could play 
plaintiff's games on their computer as opposed to 
on the console; the court found that the alleged 
infringing work was "modestly transformative" 
because it (1) created a new platform or 
environment in which consumers could play 
games designed for plaintiffs product, and (2) 
notwithstanding — the 
functions between the copyrighted and secondary 


similarity of uses and 


work, defendant's program was "a wholly new 
product"). 


Finally, Apple argues that the Corellium Product 
does not serve a transformative purpose because it 
can be used for other purposes other than security 
research and Corellium has been willing to sell to 
anyone (presumably, meaning not just to security 
researchers). This argument is not persuasive. To 
start, it is settled that an alleged infringing work 
does not need to fall within the enumerated 
examples of section 107 (e.g., research) to 
constitute fair use. Further, Apple provides no 
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authority to support its position that potential 
unintended use or a secondary use for an alleged 
infringing product precludes a finding of fair use, 
where otherwise there is evidence that the product 
serves some transformative purpose. In fact, 
caselaw seems to indicate otherwise. For example, 
in A.V. ex rel. Vanderhye v. iParadigms, LLC , 562 
F.3d 630, 634 (4th Cir. 2009), the defendant 
owned and operated an online technology system 
used by schools to evaluate originality of written 
works to prevent plagiarism. The technology gave 
schools the option of "archiving" or storing 
students’ written assignment, which then became a 
part of the defendant's database to evaluate the 
originality of other students’ works in the future. 
Id. 


The plaintiffs—the students—argued that the 
defendant's use of their works could not be 
transformative because the archiving process 
added nothing but, rather, merely stored the work 
unaltered and in its entirety. Jd. at 639. The 
appellate court was not persuaded. It held that "the 
use of a copyrighted work need not alter or 
augment the work to be transformative in nature." 
Id. And, defendant's use of plaintiffs’ works was 
transformative because it had an entirely different 
function and purpose than the original works. /d. 
The students then argued that defendant's work 
failed to "effect" its purported transformative 
purpose. Jd. at 639-40. Rejecting this argument, 
the appellate court explained that the "question of 
whether a use is transformative does not rise or 
fall on whether the use perfectly achieves its 
Id. The fact that the 
defendant's system did detect some level of 


intended purpose." 


plagiarism was sufficient, even if it was an 
imperfect system. /d. (citing Campbell , 510 U.S. 
at 582, 114 S.Ct. 1164). 


Here, there is evidence in the record to support 
Corellium's position that its product is intended for 
security research and, as Apple concedes, can be 
used for security research. Further, Apple itself 
would have used the product for internal testing 
had it successfully acquired the company. Both 
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Corellium's CEO and its VP of Sales have testified 
to the use cases for the Corellium Product for 
which they fielded inquiries. These inquiries 
pertain to, for example, application security testing 
and operating system security testing. Apple has 
presented no evidence to raise a genuine issue of 
material fact on this point. Apple points to the 
testimony of Corellium's reseller. In the quoted 


1289portion of the *1289 transcript, the deponent 
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merely speculates—stating he "believe/s] " (not 
"knows")—that Corellium wanted to "sell their 
product to whoever was interested in acquiring it." 
(Azimuth Dep. 102:25-103:3.) The deponent 
offers no facts that contradict evidence presented 
by Corellium regarding the use of the Corellium 
Product for security research. 


Therefore, the Court finds that the Corellium 
Product serves a transformative purpose. 


b. Nonprofit educational versus 


commercial purpose 


Concerning this aspect of the first factor of the fair 
use analysis, Apple argues that because the 
Corellium Product is sold commercially, and for 
significant amounts, those facts compel a finding 
in Apple's favor. (Pl.’s Resp. at 13.) Not so. To the 
contrary, the Supreme Court has cautioned against 
drawing presumptions against commercial fair 
uses. See Campbell , 510 U.S. at 583-85, 114 S.Ct. 
1164 (reversing appellate court finding that 
alleged infringing work done for profit could not 
be fair use and reiterating that the commercial or 
nonprofit character of a work is not conclusive but 
merely factors to be weighed under the fair use 
analysis). Furthermore, "the more transformative 
the new work, the less will be the significance of 
other factors, like commercialism, that may weigh 
against a finding of fair use." /d. at 579, 114 S.Ct. 
1164. "Many of the most universally accepted 
forms of fair use ... are all normally done 
commercially for profit." Authors Guild , 804 F.3d 
at 219. 
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The Court has found that the Corellium Product is 
transformative; it adds something new to iOS, 
with a further purpose or different character than 
Apple's iOS devices. Hence, Corellium's profit 
motivation does not undermine its fair use 
defense, particularly considering the public benefit 


of the product. 


Therefore, both facets of the first factor favor a 
finding of fair use. 


2. Nature of the copyrighted work 


This second factor recognizes that there is a 
hierarchy of copyright protection depending upon 
the nature of the copyrighted work. Peter 
Letterese & Assocs. , 533 F.3d at 1312 (citation 
omitted). "Works that are ‘closer to the core of 
intended copyright protection,’ and thus merit 
greater protection, include original as opposed to 
derivative works; creative as opposed to factual 
works; and unpublished as opposed to published 
works." /d. (citation omitted). "Although ‘software 
products are not purely creative works,’ it is well 
established that copyright law protects computer 
software." Oracle Am. , 886 F.3d at 1204 (citation 
omitted). 


That said, there are significant limitations on 
copyright protection for software. See, e.g., Sony 
Comput. Entm't , 203 F.3d at 602 (concluding that 
defendant's intermediate copying and use of 
plaintiff's software program was a fair use for the 
purpose of gaining access to the unprotected 
elements of plaintiff's software, and explaining 
that while the "object code of a program may be 
copyrighted as expression ... it also contains ideas 
and performs functions that are not entitled to 
copyright protection."); Oracle Am., Inc. v. Google 
Inc. , 750 F.3d 1339, 1360 (Fed. Cir. 2014) 
("Under the merger doctrine, a court will not 
protect a copyrighted work from infringement if 
the idea contained therein can be expressed in only 
one way. For computer programs, ‘this means that 
when specific [parts of the code], even though 
previously copyrighted, are the only and essential 
means of accomplishing a given task, their later 
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use by another will not amount to infringement.’ 
") (internal citation omitted). These limitations on 
copyright protection for software are important; 


1290they ensure that the primary objective *1290 of 


copyright—the progress of science and art— 
continues to be served. See Feist Publ'ns, Inc. , 
499 U.S. at 349, 111 S.Ct. 1282 (citing the 
Copyright Clause) ; Sega Enters. Ltd. v. Accolade, 
Inc. , 977 F.2d 1510, 1527 (9th Cir. 1992), as 
amended (Jan. 6, 1993). 


Corellium argues that, based on the interest of 
security researchers, the Corellium Product makes 
use of the functional aspects of iOS, as opposed to 
Apple's creativity, and those functional aspects are 
not protectable. In response, Apple briefly states 
that iOS is "sophisticated," "popular," and its 
"development necessarily involved significant 
creativity," but does not otherwise mount an 
adequate challenge to Corellium's position. 


While the Court notes the limitations on copyright 
protection for software, in the end, this "factor has 
rarely played a _ significant role in the 
determination of a fair use dispute." Authors Guild 
, 804 F.3d at 220. Thus, the Court moves to the 
next factor. 


3. Size and significance of portion of 
the copyrighted work that was copied 


"This third factor examines whether defendants 
have helped themselves overmuch of the 
copyrighted work in light of the purpose and 
character of the use." Patton , 769 F.3d at 1271 
(citation and internal marks omitted). Apple 
contends that Corellium has done so, by 
extracting, copying, publicly displaying, and 
modifying 10S. 


The quantity of the copyrighted work copied does 
not give rise to any presumption. To the contrary, 
"courts have rejected any categorical rule that a 
copying of the entirety [of the copyrighted work] 
cannot be a fair use." Authors Guild , 804 F.3d at 
221. "Even 
transformative so long as the copy serves a 


verbatim copying may _ be 
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different function than the original work." Patton , 
769 F.3d at 1262 (internal marks and citation 
omitted). "Complete unchanged copying has 
repeatedly been found justified as fair use when 
the copying was reasonably appropriate to achieve 
the copier's transformative purpose and was done 
in such a manner that it did not offer a competing 
substitute for the original." Authors Guild , 804 
F.3d at 221. So, the appropriate inquiry under this 


moe 


factor is whether " ‘the quantity and value of the 
materials used ... are reasonable in relation to the 
purpose of the copying.’ " Patton , 769 F.3d at 
1272 (quoting Campbell , 510 U.S. at 586, 114 
S.Ct. 1164 ). In making this determination, courts 
consider not only the quantity of the materials 
used, but their quality and importance, too. /d. at 
1271. " ‘[T]he amount and substantiality of the 
portion used’ is measured with respect to the 
‘copyrighted work as a whole,’ not to the 
putatively infringing work." Peter Letterese & 
Assocs. , 533 F.3d at 1314-15 (citation omitted) 


Apple argues that, to the extent Corellium users 
are only interested in a subset of iOS, Corellium's 
use of iOS is not proportional as "the entire 
IPSW" is copied. This argument has no merit. iOS 
is contained in the IPSW files and, therefore, it is 
necessary to download and explore the IPSW files 
to access iOS. Once imported from Apple's 
servers, to create a virtual device on the Corellium 
Product, the files are transiently stored and then 
modified by altering aspects of iOS and adding 
Corellium's own code. This use of the IPSW files 
is permissible and proportional, particularly 
considering the transformative finished product. 
See, e.g. , Sony Comput. Entm't , 203 F.3d at 602- 
10 (concluding that defendant's intermediate 
copying and use of plaintiffs software program 
was a fair use); Sega Enters. , 977 F.2d at 1527-28 
("[W]here disassembly is the only way to gain 
access to the ideas and functional elements 
embodied in a copyrighted computer program and 
where there is a legitimate reason for seeking such 


1291access, disassembly *1291 is a fair use of the 


copyrighted work, as a matter of law."); Authors 
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Guild , 804 F.3d at 221 (finding defendant's 
copying of entire original copyrighted books 
permissible because it was necessary to serve the 
purpose of the alleged infringing work of making 
significant information about those books 
available, permitting a searcher to identify a word 
or term of interest and to learn the frequency of 
usage, and to show the searcher just enough 
context surrounding the searched term to help her 
evaluate whether the book falls within the scope of 
her interest). '” 


12 Tn this vein, the Court also finds 
Corellium's download and use of the 
publicly available IPSW files solely for its 


own internal testing is permissible. 


Corellium's copying, modifying, and using of iOS 
is reasonable in relation to the purpose of the 
copying. The testimony is that the Corellium 
Product is intended to create a virtual environment 
in which users can, for instance, examine, test, and 
research iOS or portions of iOS code.'? To be an 
efficient and effective research environment that 
accurately reflects the operation of iOS on Apple's 
devices, the Corellium Product necessarily utilizes 
iOS. In line with this purpose, the Corellium 
Product excludes or does not virtualize the full 
functionality of features available on iOS devices, 
like Face ID, Touch ID, baseband, camera, the 
App Store, and so on. Users of the Corellium 
Product cannot make calls or send text messages, 
which can be done on an iPhone. 


13 As stated earlier, the Corellium Product is 
also capable of virtualizing Android and 
Linux, and it can run any operating system 
on the virtual Apple product once it has 
restore ramdisk. (Wang Dep. 177:10- 
178:25.) The Corellium Product does not 
need a particular operating system. Jd. 
Because only iOS is at issue in this case, 
the Court focuses on users interacting with 
iOS. 


In permitting users to interact with the virtual 
device, the Corellium Product allows users to 
view certain graphical user elements (like the 
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iPhone home screen or wallpaper). The evidence 
does not reflect that these images serve a central 
purpose or are of principal importance to the 
overall functionality of the Corellium Product, or 
are a major part of Apple's complex copyrighted 
work as a whole.'* Thus, Corellium's use of these 
graphical elements does not undermine a finding 
of fair use. See, e.g. , Solid Oak Sketches, LLC v. 
2K Games, Inc. , 449 F. Supp. 3d 333, 349 
(S.D.N.Y. 2020) (finding in case against an 
interactive entertainment and video game 
company brought by licensee of copyrighted 
tattoos used by professional basketball players 
that, while the tattoos were copied in their entirety, 
defendants did so in order to effectuate the 
transformative purpose of creating a realistic game 
experience); Sony Comput. Entm't Am., Inc. v. 
Bleem, LLC , 214 F.3d 1022, 1028-29 (9th Cir. 
2000), amended on denial of reh'g (July 10, 2000) 
(finding in case brought by a manufacturer of 
console video games against a developer of a 
software emulator, alleging that developer's use of 
"screen shots" from manufacturer's games in 
developer's advertising violated manufacturer's 
copyright, that developer's degree of copying was 
reasonable where the "screen shots" at issue were 
a small portion of the complex copyrighted work 
as a whole). 


14 See Wang Dep. 215:4-217:16. 


Upon reviewing the evidence, the Court finds that 
Corellium's use of iOS (in terms of quantity, 
quality, and importance) is proportional and 
necessary to achieve Corellium's transformative 
purpose. Therefore, this third factor weighs in 
favor of finding fair use. 


4. Effect of allegedly infringing use 
on potential market for or value of the 
original 

"With respect to the fourth factor—the effect of 


1292the use on the value *1292 of the copyrighted 


is whether the 
infringement impacted the market for the 
copyrighted work itself." Lexmark Int'l , 387 F.3d 


material—the relevant question ... 


VF 
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at 544 (citation omitted). This factor "focuses on 
whether the copy brings to the marketplace a 
competing substitute for the original, or its 
derivative, so as to deprive the rights holder of 
significant revenues because of the likelihood that 
potential purchasers may opt to acquire the copy 
in preference to the original." Authors Guild , 804 
F.3d at 223. The adverse impact courts are 
primarily concerned with is that of market 
substitution. Patton , 769 F.3d at 1275 (citation 
omitted). 


In this lawsuit, Apple asserts 17 copyrights 
pertaining to iOS; alleged copyrights in 12 
versions of iOS released since 2015 and 5 
copyrights in visual works of arts contained in iOS 
(i.e., icons of Apple's built-in applications and 
wallpaper). Concerning this fourth factor, there is 
no evidence that the Corellium Product has 
affected, let alone materially affected, Apple's 
market or the market value for iOS. Instead, Apple 
argues that Corellium markets its product as an 
alternative to an iPhone and lists Apple's "iOS 
Simulator" as a direct competitor. This marketing 
—whether puffery or factually accurate—is not 
evidence that the Corellium Product supplants 
Apple's market for iOS devices or that it has 
deprived, or will deprive, Apple of (significant) 


revenue made from iOS. 


Next, Apple argues that the Corellium Product 
will compete with its upcoming Security Research 
Device Program, under which Apple will be 
licensing devices running iOS to security 
researchers in return for the disclosure of security 
vulnerabilities and related discoveries to Apple. 
This argument misses the mark. The relevant 
question under this fourth factor is whether the 
Corellium Product has impacted the market for the 
copyrighted work itself—that is, for iOS. See, e.g. 
, Lexmark Int'l , 387 F.3d at 545 (noting that the 
"the district court focused on the wrong market: it 
focused not on the value or marketability of the 
Toner Loading Program, but on Lexmark's market 
for its toner cartridges. Lexmark's market for its 


toner cartridges and the profitability of its Prebate 
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program may well be diminished by the 
[defendant's] SMARTEK chip, but that is not the 
sort of market or value that copyright law 
protects."). Here, while Apple may very well 
expand into the security research or virtualization 
law does not confer a 


market, copyright 


monopoly. Sony Comput. Entm't , 203 F.3d at 607. 


This principle equally applies to Apple's final 
argument, that it previously rejected the option of 
"licensing exactly this kind of software" (that is, a 
product like the Corellium Product). (P1.’s Resp. at 
17.) "[A] copyright holder can always assert some 
degree of adverse [effect] on its potential licensing 
revenues as a consequence of the secondary use at 
issue simply because the copyright holder has not 
been paid a fee to permit that particular use." 
Patton , 769 F.3d at 1276 (citation omitted, italics 
in original). "The goal of copyright is to stimulate 
the creation of new works, not to furnish copyright 
holders with 
Accordingly, the ability to license does not 


control over all markets. 


demand a finding against fair use." Jd. 


The Court does not find any significant market 
impact on iOS. Thus, this fourth factor also favors 
a finding of fair use. 


5. Good faith and fair dealing 


In addition to, or as a part of, the four statutory 
Apple asks the 
Corellium's lack of good faith and fair dealing. 


factors, Court to consider 
According to Apple, "Corellium's conduct has 
been entirely improper" because it deals with bad 
actors and does not require users to report bugs to 


1293 Apple.*1293 Apple's position is puzzling, if not 


disingenuous. [Redacted]. (Krstic Dep. 184:22- 
185-10.) Likewise, while Apple spends significant 
time in its papers faulting Corellium for not 
requiring users of the Corellium Product to report 
bugs found in iOS to Apple, Apple does not 
impose that requirement under its own Bug 
Bounty Program. As for Apple's contention that 
Corellium sells its product indiscriminately, that 
statement is belied by the evidence in the record 
that the company has a vetting process in place 
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(even if not perfect) and, in the past, has exercised 
its discretion to withhold the Corellium Product 
from those it suspects may use the product for 
nefarious purposes. !° 


15 The Court does realize that with or without 
controls in place, the Corellium Product 
could be used maliciously in the wrong 
hands. As Apple's Jason Shirk aptly states: 
"Tools are agnostic; It's all the user." (Shirk 
Dep. [DE 472-31] 118:24.) The Corellium 
Product can be used for "good faith" 
security research and it also very likely can 
be exploited for nefarious reasons. No 
technology is infallible. For instance, 
notwithstanding strong protections put in 
place by Apple such as the secure boot 
chain, just recently the checkm8 exploit 
was released by security researchers, which 
enables certain iOS commercial devices to 


be jailbroken. (Shirk Dep. 94:11-20.) 


Having reviewed the evidence, the Court does not 
find a lack of good faith and fair dealing. Further, 
weighing all the necessary factors, the Court finds 
that Corellium has met its burden of establishing 
fair use. Thus, its use of iOS in connection with 
the Corellium Product is permissible. On these 
grounds, Corellium's Motion for Summary 
Judgment is granted on Apple's copyright claim. 


Il. DMCA CLAIM 


Both Corellium and Apple seek summary 
judgment on Apple's DMCA claim. The claim is 
brought under sections 1201(a)(2) and (b)(1) of 
the statute, which together prohibit selling tools to 
circumvent measures that protect access to, or 
rights in, copyrighted material, if the tools: (a) are 
"primarily designed or produced for the purpose of 
circumventing a technological measure that 
effectively" controls access to or protects rights in 
a copyrighted work; (b) have "only limited 
commercially significant purpose or use other than 
to circumvent a technological measure that 
effectively" controls access to or protects rights in 
a copyrighted work; or (c) are "marketed ... for use 
in circumventing a technological measure that 
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effectively" controls access to or protects rights in 
a copyrighted work. 17 U.S.C. § 1201(a)(2), (b) 
(1). Under the DMCA, to "circumvent a 
technological measure" means to "to avoid, 
bypass, remove, deactivate, or impair a 
technological measure, without the authority of 
the copyright owner," and a technological measure 
" ‘effectively controls access to a work’ if the 
measure, in the ordinary course of its operation, 
requires the application of information, or a 
process or a treatment, with the authority of the 
copyright owner, to gain access to the work." 17 


U.S.C. § 1201(a)(3). 


Apple argues that, at a minimum, Corellium 
circumvents its authentication server validation 
check, secure boot chain, Buddy program, and 
trust cache. According to Apple, only after 
circumventing these measures can the Corellium 
Product run iOS—which was not designed to run 
on non-Apple hardware. Corellium disagrees that 
it circumvents Apple's technological measures. 
Corellium argues instead that the IPSW files are 
"left unencrypted, unprotected, unlocked, and out 
in the open for the public to access, copy, edit, 
distribute, perform, and display." (Def.’s Resp. 
[DE 512] at 1.) Corellium further argues that it is 
entitled to a fair use defense, as well as defenses 
under sections 1201(f), (g), and (j) of the DMCA, 


1294which provide exemptions *1294 for reverse 


engineering and security testing and encryption 
research. The Court begins by examining whether 
fair use is a defense to a prima facie section 1201 


violation. 


A. "Fair use" and the DMCA 
The DMCA provides: 


(c) Other rights, etc., not affected.--(1) 
Nothing in this section shall affect rights, 
remedies, limitations, or defenses to 
copyright infringement, including fair use , 
under this title. 


17 U.S.C. § 1201(c) (italics added). At first 
glance, this subsection appears to resolve the issue 
of a fair use defense. But, as applied, there may be 
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tension between section 107 ’s fair use and the 
DMCA's antitrafficking provisions. One court 
captured the issue well: 


Technological access control measures 
have the capacity to prevent fair uses of 
copyrighted works as well as foul. Hence, 
there is a potential tension between the use 
of such access control measures and fair 
use, [as well as the much broader range of 
explicitly noninfringing use]. As the 
DMCA made its way through the 
legislative process, Congress was 
preoccupied with precisely this issue. 
Proponents of strong restrictions on 
circumvention of access control measures 
argued that they were essential if copyright 
holders were to make their works available 
in digital form because digital works 
otherwise could be pirated too easily. 
Opponents contended that strong 
anticircumvention measures would extend 
the copyright monopoly inappropriately 
and prevent many fair uses of copyrighted 
material. Congress struck a balance .... 


Chamberlain Grp., Inc. v. Skylink Techs., Inc. , 
381 F.3d 1178, 1196-97 (Fed. Cir. 2004) (citing 
Reimerdes , 111 F. Supp. 2d at 304 ).'° 


16 This year—more than twenty years after 
the DMCA was enacted—with a series of 
hearings, Congress has begun to review the 
DMCA, including a review of how the 
DMCA has accounted for fair use, how fair 
use has been applied in practice, and how a 
reform bill should think about fair use. See, 
e.g. , How Does the DMCA Contemplate 
Limitations and Exceptions Like Fair Use? 
, Subcommittee Hearing, Senate Judiciary 
Subcommittee on Intellectual Property, 
available at 
https://www.judiciary.senate.gov/meetings/ 
how-does-the-dmca-contemplate- 
limitations-and-exceptions-like-fair-use 
(last accessed December 10, 2020); see 
also The Digital Millennium Copyright Act 
at 22: What is it, why was it enacted, and 
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where are we now, available at 
https://www.judiciary.senate.gov/meetings/ 
the-digital-millennium-copyright-act-at-22- 
what-is-it-why-it-was-enacted-and-where- 
are-we-now (last accessed December 10, 
2020). 


In Chamberlain , the Federal Circuit suggested, in 
dicta, that fair use could be a defense to a section 
1201 violation. The court noted that the DMCA 
does not "rescind[ ] the basic bargain granting the 
public noninfringing and fair uses of copyrighted 
materials ...." 381 F.3d at 1202 (citing § 1201(c) ). 
In reaching that conclusion, the court was wary of 
through a 
contractual terms and 


allowing "copyright owner[s], 
combination of 
technological measures, to repeal the fair use 
doctrine ...." /d. Notwithstanding this discussion, 
the Federal Circuit ultimately stated that it did 
"not reach the relationship between § 107 fair use 
and violations of § 1201." Jd. at 1199 n.14. 
Neither the Supreme Court nor the Eleventh 
Circuit has squarely addressed the issue. And, like 
the Federal Circuit, the Ninth Circuit has put that 
decision off for another day. See MDY Indus., LLC 
v. Blizzard Entm't, Inc. , 629 F.3d 928, 950 n.12 
(9th Cir. 2010), opinion amended and superseded 
on denial of reh'g , No. 09-15932, 2011 WL 
538748 (9th Cir. Feb. 17, 2011) ("Like the [court 


in] Chamberlain ..., we need not and do not reach 


1295the relationship between fair use *1295 under § 


107 of the Copyright Act and violations of § 1201 
.... Accordingly, we too leave open the question 
whether fair use might serve as an affirmative 
defense to a prima facie violation of § 1201."). 


The Second Circuit, however, has ruled on the 
issue, and has found that fair use is not a blanket 
defense to the circumvention provisions of section 
OW 
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[Appellants] contend that subsection 
20K EOS 


circumvention of encryption technology 


can be read to allow the 


protecting copyrighted material when the 
material will be put to "fair uses" exempt 
from copyright liability. We disagree that 
subsection 1201(c)(1) permits such a 
reading. Instead, it simply clarifies that the 
DMCA targets the circumvention of digital 
walls guarding copyrighted material (and 
trafficking in circumvention tools), but 
does not concern itself with the use of 
those materials after circumvention has 
occurred. Subsection 1201(c)(1) ensures 
that the DMCA is not read to prohibit the 
"fair use" of information just because that 
information was obtained in a manner 
illegal by the DMCA. The 
more expansive 


made 
Appellants’ much 
interpretation of subsection 1201(c)(1) is 
not only outside the range of plausible 
readings of the provision, but is also 
clearly refuted by the statute's legislative 


history. 


Corley , 273 F.3d at 443-44 ; see also United 
States v. Reichert , 747 F.3d 445, 448 (6th Cir. 
2014) ("[T]he DMCA ‘targets the circumvention 
of digital walls guarding copyrighted material (and 
trafficking in circumvention tools),’ even though it 
‘does not concern itself with the use of those 
materials after circumvention has occurred.’ ") 
(citing Corley , 273 F.3d at 443 ) (italics in 
original); Realnetworks, Inc. v. DVD Copy Control 
Ass'n , 641 F. Supp. 2d 913, 941-42 (N.D. Cal. 
2009) ("The DMCA itself is, of course, rooted in 
the Copyright Act. The DMCA's section 1201(c) 
merely preserves the general fair use defense to 
copyright infringement. It does not create new 
exemptions, nor does it exempt from liability 
circumvention tools otherwise deemed unlawful 
under sections 1201(a)(2) or (b)(1) .... Fair use is 
not a defense to trafficking in products used to 
circumvent effective technological measures that 
prevent unauthorized access to, or unauthorized 
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copying of, a copyrighted work under sections 
1201(a) or (b), respectively .... [However] fair use 
applies to section 1201(b) under the DMCA 
because it does not speak to, and thus does not 
individual uses of 


prohibit, appropriate 


circumvention devices."). 


Here, if the Court were to adopt Corellium's 
position that fair use is a defense to Apple's 
DMCA claim, that would effectively render 
section 1201 meaningless. "A venerable canon 
makes clear that an interpreter must, if possible, 
give effect to every word and phrase in a statute." 
Darrisaw v. Pennsylvania Higher Educ. 
Assistance Agency , 949 F.3d 1302, 1306 (11th 
Cir. 2020) (citation). "[Courts] cannot adopt an 
interpretation that would render a _ term 
meaningless ...." Id. (citation omitted, italics in 
original). Thus, the Court finds that the better 
reading is that adopted by the Corley court. 
Therefore, Corellium may make fair use of iOS, 
but it is not absolved of potential liability for 
allegedly employing circumvention tools to 
unlawfully access iOS or elements of iOS. As 
noted earlier, this result may seem to undercut 
section 107 ’s fair use. However, in passing the 
DMCA, Congress adopted a "balanced" approach 
to accommodate both piracy and fair use concerns. 
Corley , 273 F.3d at 444 n.13. "The balance 
embodied in a federal law is not something this 
court can disturb, absent a Constitutional violation 
not at issue here." Realnetworks, Inc. , 641 F. 


Supp. 2d at 943. The Court, therefore, rejects 


1296Corellium's *1296 fair use defense in the context of 


the DMCA. 


B. Genuine issues of material facts 
exist 


Issues of material facts preclude entry of summary 
judgment on this claim. For example, there is the 
fundamental question of, and dispute as to, 
whether Apple has copyrights in all of iOS or only 
portions of 10S. While Corellium maintains that 
iOS is open for public access to support its 
position that iOS or components of iOS in the 
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IPSW files are not protectable, even open source 
material is protectable. Jacobsen v. Katzer , 535 
F.3d 1373, 1381 (Fed. Cir. 2008) ("Copyright 
holders who engage in open source licensing have 
the right to control the modification and 
distribution of copyrighted material."). The parties 
also dispute the nature of Apple's technological 
measures and the applicability of those measures 
to the IPSW files and, by extension, elements of 
iOS in those files. Likewise, Corellium alleged 
statutory defenses raise factual questions that 
preclude entry of summary judgment on this 
claim. Therefore, the parties’ motions are denied 
as they relate to the DMCA claim. Accordingly, it 


1S 
ORDERED that: 


1. Apple's Motion for Partial Summary Judgment 
[DE 470] is DENIED ; 


2. Corellium's Motion for Summary Judgment 
[DE 464] is GRANTED IN PART AND 
DENIED : 
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a. The Motion is granted on the copyright 
claims, to the extent the Court finds that 
Corellium's use of 10S constitutes fair use; 


b. The Motion is denied regarding the 
DMCA claim. 


3. No later than January 11, 2021 , the parties 
shall each file a status report notifying the Court 
of any portions of pending motions rendered moot 
by this Order. 


DONE AND ORDERED in Fort Lauderdale, 
Florida, this 29th day of December 2020. 
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